hawkeye | 71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56 | Triage

Submit
Reports

Overview

overview

Static

static

71fed7ed10...56.exe

windows7-x64

71fed7ed10...56.exe

windows10-2004-x64

9

Sharing

General

Target

71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56
Size

612KB
Sample

221119-h7mkwaed4w
MD5

5d63001f838b055e90c18716ec8e66d0
SHA1

c5db07048280a48f546ecbe28d4e56bd5a59dbdc
SHA256

71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56
SHA512

bc1c55dcf0f1ef8290b83cbb7eb1747ce5639ddeea1f1ef4de6970868c3504ec357a214fb840157df60a1086a2b6159ccb112771ba98df7d26aa107edda02c66
SSDEEP

12288:oZlfW/AeHDG0R3f00Ic5i+hKQzavrWsIK7IyZutgIrmW:IRpeSUPBVxajWNSpZutgIrh

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56.exe

Resource

win7-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56
- Size
  
  612KB
- MD5
  
  5d63001f838b055e90c18716ec8e66d0
- SHA1
  
  c5db07048280a48f546ecbe28d4e56bd5a59dbdc
- SHA256
  
  71fed7ed10ae5711ace19104a61d1aa8baa952acbbee6934d8fe5b032e495b56
- SHA512
  
  bc1c55dcf0f1ef8290b83cbb7eb1747ce5639ddeea1f1ef4de6970868c3504ec357a214fb840157df60a1086a2b6159ccb112771ba98df7d26aa107edda02c66
- SSDEEP
  
  12288:oZlfW/AeHDG0R3f00Ic5i+hKQzavrWsIK7IyZutgIrmW:IRpeSUPBVxajWNSpZutgIrh
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy